How to Add a User to a Group in Linux

When you need to give a Linux user access to Docker, sudo, shared directories, or other protected resources, you usually add the user to a group. Groups let you manage permissions for several users at once instead of changing permissions for each account separately.

This guide explains how to add an existing user to a Linux group, add a user to multiple groups, change a user’s primary group, and verify that the change was applied.

There are two types of groups:

• Primary group: assigned to a user when the account is created. Usually, the name of the primary group is the same as the username. When a user creates a file, the file’s group is set to the user’s primary group. The primary group is stored in the /etc/passwd file.
• Secondary (supplementary) groups: used to grant additional permissions. For example, adding a user to the docker group allows them to run Docker commands without sudo.

Each user has exactly one primary group and can belong to zero or more secondary groups.

Only root or users with sudo privileges can modify group membership.

Quick Reference #

For a printable quick reference, see the useradd cheatsheet .

Displaying User Groups #

Before modifying groups, it is useful to check a user’s current group membership.

The id command displays the user’s UID, primary group, and all secondary groups:

id linuxize

uid=1000(linuxize) gid=1000(linuxize) groups=1000(linuxize),27(sudo),1001(developers)

The groups command prints only the group names:

groups linuxize

linuxize : linuxize sudo developers

If you omit the username, both commands display information for the currently logged-in user.

Listing All Groups on the System #

To list all groups on the system:

getent group

To list all members of a specific group:

getent group docker

docker:x:993:deploy

Our guide on listing groups in Linux covers more ways to read group membership, including reading /etc/group directly.

Adding a User to a Group #

Before changing group membership, make sure both the user and group already exist. The usermod command does not create missing users or groups for you.

Check the user with getent passwd:

getent passwd linuxize

Check the group with getent group:

getent group docker

If both commands return entries, you can add the user to the group.

To add an existing user to a secondary group, use the usermod -a -G command followed by the group name and the username:

sudo usermod -a -G groupname username

For example, to add the user linuxize to the docker group:

sudo usermod -a -G docker linuxize

The -a and -G options are usually written together as -aG. It is the same command in a shorter form.

On success, the command produces no output. Verify the new membership with id:

id linuxize

uid=1000(linuxize) gid=1000(linuxize) groups=1000(linuxize),27(sudo),993(docker),1001(developers)

Group changes apply after the user logs out and logs back in. To apply the change in the current session, run:

newgrp docker

The newgrp command starts a shell with the selected group as the active group. For normal login sessions, logging out and signing back in is the cleaner option.

Adding a User to Multiple Groups #

To add a user to multiple secondary groups at once, separate the group names with commas (no spaces):

sudo usermod -a -G group1,group2,group3 username

For example, to add linuxize to the docker and developers groups:

sudo usermod -a -G docker,developers linuxize

Do not put spaces after the commas. usermod expects one comma-separated list.

Using adduser on Debian and Ubuntu #

Debian, Ubuntu, and their derivatives ship the adduser command. Pass it an existing user and an existing group, and it adds the user to that group:

sudo adduser username groupname

For example, to add linuxize to the docker group:

sudo adduser linuxize docker

The result is the same as usermod -aG docker linuxize. There is no append flag to remember, so you cannot drop the user from other groups by accident.

Older releases print a short confirmation. Ubuntu 26.04 and Debian 13 ship adduser 3.138 or newer. That version keeps those status lines off the console. The command still succeeds. Verify the result with id:

id linuxize

This two-argument form belongs to Debian and its derivatives. On Fedora, RHEL, and their derivatives, adduser is a symbolic link to useradd, so use usermod there.

Adding a User to the sudo or wheel Group #

Administrative access is the most common reason to change a user’s groups. The group name depends on the distribution.

On Debian, Ubuntu, and their derivatives, members of the sudo group can run commands as root:

sudo usermod -aG sudo linuxize

On Fedora, RHEL, and their derivatives, the same privileges come from the wheel group:

sudo usermod -aG wheel linuxize

Both groups get their powers from a single rule in /etc/sudoers. On Debian and Ubuntu that rule reads %sudo ALL=(ALL:ALL) ALL, and on Fedora and RHEL it reads %wheel ALL=(ALL) ALL. The percent sign marks a group rule instead of a user rule.

If you are not sure which group your system uses, read the rule directly:

sudo grep -E '^%(sudo|wheel)' /etc/sudoers

The user must log out and log back in before the new privileges take effect. For rules that grant only specific commands, see our guides on adding a user to sudoers in Ubuntu , Debian , and CentOS .

Changing a User’s Primary Group #

To change a user’s primary group, use usermod with the lowercase -g option:

sudo usermod -g groupname username

For example, to change the primary group of the user linuxize to developers:

sudo usermod -g developers linuxize

Note the difference: -G (uppercase) sets secondary groups, -g (lowercase) sets the primary group.

Creating a User with Groups #

The useradd command can assign both primary and secondary groups when creating a new user:

sudo useradd -g users -G wheel,developers nathan

This creates a user nathan with users as the primary group and wheel and developers as secondary groups.

Removing a User from a Group #

To remove a user from a group, use the gpasswd command with the -d option:

sudo gpasswd -d username groupname

For example, to remove linuxize from the docker group:

sudo gpasswd -d linuxize docker

Creating and Deleting Groups #

To create a new group :

sudo groupadd groupname

To delete a group :

sudo groupdel groupname

You cannot delete a group that is a user’s primary group. Change the user’s primary group first.

Troubleshooting #

Group changes do not apply in the current shell
Linux reads a user’s groups when the session starts. If id username shows the new group but the user still cannot access the resource, log out and log back in. For a temporary shell with the new group, run newgrp groupname.

usermod: user 'username' does not exist
The username is missing or spelled differently. Check the account with getent passwd username. If you need to create the user first, use useradd or your distribution’s user management tool.

usermod: group 'groupname' does not exist
The group must exist before you can add a user to it. Check it with getent group groupname. If it is missing, create it with sudo groupadd groupname, then run usermod -a -G groupname username again.

The user lost access to other groups after running usermod -G
This happens when -G is used without -a. The command replaces the user’s secondary groups with the groups listed after -G. Add the missing groups back with sudo usermod -a -G group1,group2 username, then verify with id username.

adduser username groupname fails on Fedora or RHEL
On Fedora, RHEL, and their derivatives, /usr/sbin/adduser is a symbolic link to useradd. That command accepts only one account name, so it prints a usage error and does not add the user to the group. Use sudo usermod -aG groupname username on those systems.

FAQ #

What happens if I forget the -a flag with usermod -G?
The user will be removed from all secondary groups except those listed in the command. This is the most common mistake when managing groups. Always use -a -G together.

Do group changes take effect immediately?
No. The user must log out and log back in for the new group membership to take effect. You can verify by running id username; the change shows up there immediately, but the user’s active session still uses the old groups.

What is the difference between -g and -G in usermod?
Lowercase -g sets the user’s primary group. Uppercase -G sets secondary (supplementary) groups. When used with -a, -G appends to the existing list instead of replacing it.

What is the difference between adduser and usermod for group changes?
On Debian and Ubuntu, sudo adduser username groupname adds an existing user to an existing group in one step. usermod -aG groupname username does the same thing and works on every distribution. Use adduser for interactive work on Debian-based systems, and usermod in scripts or on Fedora and RHEL.

How do I add my own account to a group?
Use the $USER variable so you do not have to type your username: sudo usermod -aG docker $USER. The change does not reach the shell you are sitting in. Log out and log back in, or start a new session with newgrp docker.

How do I find out which groups exist on the system?
Run getent group to list all groups, or getent group groupname to check whether a specific group exists and see its members.

Can a user belong to multiple primary groups?
No. Each user has exactly one primary group. To grant access to multiple resources, use secondary groups.

Conclusion #

The usermod -a -G command adds existing users to secondary groups in Linux. Use id, groups, and getent to verify the change, and always include -a when working with -G so existing group memberships stay intact.

About the authors

Dejan Panovski

Dejan Panovski is the founder of Linuxize, an RHCSA-certified Linux system administrator and DevOps engineer based in Skopje, Macedonia. Author of 1000+ Linux tutorials with 20+ years of experience turning complex Linux tasks into clear, reliable guides.

View author page